sestatus show selinux status
getenforce show enforcing status of selinux
setenforce enforcing|permissive set status of selinux
getsebool -a show the boolean value of the service
setsebool -P set the the boolean value
chcon - u(user) -r (role) -t (type) change context of a file
chcon --reference=<dir> <dir_to_change_context> copy the context of the dir as referrence
restorecon -F myfile restore file default file context
User
unconfined_u unprotected user
system_u system user
user_u normal user
Role
object_r file
system_r users processes
domain
unconfined_r unprotected file or process
Set enforcing and permissive modes for SELinux
-thru configfile edit /etc/sysconfig/selinux
-or use the command setenforce
#setenforce Enforcing|Permissive
List and identify SELinux file and process context
- File
ls -lZ
-Process
ps -eZ|grep <process name>
Restore default file contexts
restorecon -F myfile
chcon - u(user) -r (role) -t (type) change context of a file
chcon --reference=<dir> <dir_to_change_context> copy the context of the dir as referrence
Use boolean settings to modify system SELinux settings
getsebool -a show the boolean value of the service
setsebool -P <boolean>=1/0 set the the boolean value
Diagnose and address routine SELinux policy violations
To get man pages for a certain commands
man -k _selinux
Description of the boolean
semanage boolean -l #provided by the policycoreutils-python
To survive a SELinux relabel
ex: #semanage fcontext -a -s system_u -t httpd_sys_script_exec_t /var/www/cgi-bin
